Declarative rules versus programmable edges — Cloudflare Rulesets, Akamai Property Manager, Fastly VCL, CloudFront policies and the value-tier rule builders, compared by where they run out.
Winner depends on your workload.
Winner depends on: how far your logic goes before it needs a variable. Akamai's Property Manager and Cloudflare's Rulesets carry the most behavior declaratively; Fastly skips straight to a full language (VCL) and is honest about it; CloudFront keeps the declarative layer thin and expects Functions to fill the gap; the value tier's rule builders cover the common 80% cheaply.
Every edge has two layers; the border differs
All modern CDNs split edge behavior into a declarative layer — match conditions, take actions, no loops — and a programmable layer where real code runs. The engineering question when choosing a platform is where that border sits, because everything expressible in rules is cheaper, safer and more auditable than the equivalent code, and everything past the border is a software project. The platforms draw it in strikingly different places.
| Provider | Declarative layer | Where it runs out |
|---|---|---|
| Cloudflare | Rulesets engine — filter expressions driving Transform, Redirect, Cache, Origin and Config rules, with quotas by plan | Anything stateful, loops, external calls → Workers |
| Akamai | Property Manager — criteria/behavior trees of unmatched breadth, versioned and activatable per network | Genuine computation → EdgeWorkers; the rules layer itself stretches remarkably far |
| Fastly | Minimal GUI rules; the platform's native tongue is VCL, a domain-specific language compiled per service | Never quite "runs out" — VCL is code; its limits (no loops, restricted state) push you to Compute |
| Amazon CloudFront | Behaviors plus managed cache/origin-request policies — deliberately thin | Early: header rewrites, redirects and A/B logic go to CloudFront Functions or Lambda@Edge |
| Azure Front Door | Rules engine of match conditions and actions per route | Moderate coverage; complex logic needs your app or another layer |
| Bunny / Gcore / CDN77 | Edge Rules-style builders: triggers and actions for redirects, headers, caching, blocking | The common 80% is covered; the remaining 20% is a platform upgrade |
Two philosophies of the border
Akamai and Cloudflare represent the maximalist school: push the declarative layer as far as it will go. Property Manager encodes twenty-plus years of delivery pattern into behaviors — the reason complex Akamai estates can run enormous logic with no code at all, and also the reason its configs need genuine expertise to review. Cloudflare's Rulesets take a more modern shape — one expression language across products, wire-format filters, API-first versioning — and quota rule counts by plan, a line item worth checking before you design around them. Fastly is the minimalist-honest school: rather than grow a GUI to approximate programming, it hands you VCL, with the power and the review burden of real code — the same trade we scored in Fastly Compute vs Cloudflare Workers. CloudFront splits the difference by keeping rules thin and making its code tier unusually cheap at the light end, per CloudFront Functions vs Lambda@Edge.
Why the border placement matters operationally
Three reasons to prefer rules while they last. Auditability: a security reviewer can read a rule table; reviewing edge code is a code review. Blast radius: declarative engines constrain what a change can break, and platform-side validation catches contradictions code would happily execute. Portability: simple rules translate across vendors in an afternoon, while logic embedded in VCL or Workers is the single biggest source of multi-CDN config drift — the seam we scored in the friendliness index. The counterweight is real too: a rules layer stretched past its nature becomes its own obscure programming language, and a hundred interacting rules can be harder to reason about than thirty lines of code doing the same thing.
Choosing by your logic's shape
Inventory what your edge actually does: redirects, header hygiene, cache keys, geo and bot gating, A/B bucketing, token checks. If the list is all matches-and-actions, any maximalist engine — or a value-tier builder at a fraction of the price — carries it. If it contains one genuinely computational item, place the platform bet deliberately: that item will decide your programmable tier, and the programmable tier, not the rules engine, is what you will still be living with in five years. Facts verified against provider documentation, July 2026.
Not sure whether your edge logic is a rules table or a software project? The assessment inventories it and prices both paths.